Is CVE-2026-30905 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30905 being exploited in the wild.

How severe is CVE-2026-30905?

High severity, with a CVSS score of 7.8, published 13 May 2026.

Which products and versions are affected?

Zoom Workplace VDI Plugin Windows Universal Installer before 6.6.11.

Is there a fix for CVE-2026-30905?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-30905 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-30905?

Check whether you run Zoom Workplace VDI Plugin Windows Universal Installer or Zoom Workplace Virtual Desktop Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30905: Zoom Workplace VDI Plugin privilege escalation in Windows Universal Installer

CVE-2026-30905 · Severity: high · CVSS 7.8 · Published 2026-05-13

A security vulnerability in the Zoom Workplace VDI Plugin for Windows could allow a person with existing access to a computer to gain higher-level administrative privileges. This plugin is typically used in virtual desktop environments to optimize video conferencing performance. If exploited, an attacker could gain full control over the local system, potentially leading to unauthorized software installation or access to sensitive data.

Technologies: Zoom Workplace Virtual Desktop Infrastructure. Vendors: Zoom.

Quick answers

Is CVE-2026-30905 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30905 being exploited in the wild.
How severe is CVE-2026-30905?: High severity, with a CVSS score of 7.8, published 13 May 2026.
Which products and versions are affected?: Zoom Workplace VDI Plugin Windows Universal Installer before 6.6.11.
Is there a fix for CVE-2026-30905?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-30905 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-30905?: Check whether you run Zoom Workplace VDI Plugin Windows Universal Installer or Zoom Workplace Virtual Desktop Infrastructure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as External Control of File Name or Path (CWE-73) within the Zoom Workplace VDI Plugin Windows Universal Installer. It occurs when the installer or plugin component fails to properly validate or restrict file paths provided by a user, allowing an attacker to reference resources in unauthorized locations. An authenticated local attacker with low privileges can exploit this flaw to execute code or manipulate system files with higher privileges (Escalation of Privilege). The issue is resolved in version 6.6.11 and later.

Affected products

Zoom Workplace VDI Plugin Windows Universal Installer before 6.6.11

Timeline

2026-05-12: advisory: Initial publication of ZSB-26007 by Zoom
2026-05-13: disclosed: CVE published to NVD

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26007

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.